Wicked Crypto
Total Page:16
File Type:pdf, Size:1020Kb
Scholarship Repository University of Minnesota Law School Articles Faculty Scholarship 2019 Wicked Crypto Alan Rozenshtein Follow this and additional works at: https://scholarship.law.umn.edu/faculty_articles Recommended Citation Alan Rozenshtein, Wicked Crypto, 9 1181 (2019), available at https://scholarship.law.umn.edu/ faculty_articles/699. This Article is brought to you for free and open access by the University of Minnesota Law School. It has been accepted for inclusion in the Faculty Scholarship collection by an authorized administrator of the Scholarship Repository. For more information, please contact [email protected]. Final to Printer_Rozenshtein (Do Not Delete) 8/12/2019 2:23 PM Wicked Crypto Alan Z. Rozenshtein* Introduction ................................................................................................................... 1181 I. Encryption and Public Safety .................................................................................. 1184 A. Encryption and Exceptional Access ........................................................ 1185 B. Encryption as a Tool for Victims of Crime ............................................ 1186 C. Encryption as a Tool for Criminals ......................................................... 1186 II. Encryption as a Wicked Problem .......................................................................... 1189 A. Introduction to Wicked Problems ........................................................... 1189 B. Dimensions of Wickedness ....................................................................... 1190 1. There Is No Agreement on Goals ....................................................... 1191 2. Information Is Uncertain and Diffuse ................................................ 1192 3. The Problem Cannot Be Fully or Permanently Solved ................... 1196 III. Lessons ..................................................................................................................... 1197 A. Beware Easy Answers ................................................................................ 1197 1. Exceptional-Access Mandates .............................................................. 1198 2. “Going Dark” vs. “A Golden Age of Surveillance” ......................... 1200 B. Focus on Imperfect Solutions: The Case of Lawful Hacking ............. 1206 C. Invest in Knowledge Production ............................................................. 1210 D. Improve Relationships Between the Government and the Technology Community......................................................................... 1211 Conclusion ...................................................................................................................... 1215 INTRODUCTION More than thirty years ago, historian of technology Melvin Kranzberg put forward his famous “First Law”: “Technology is neither good nor bad; nor is it * Associate Professor of Law, University of Minnesota Law School. For helpful comments, I thank Steven Bellovin, Susan Landau, Mayank Varia, my colleagues at the University of Minnesota Law School, and participants at the Arizona State University Sandra Day O’Connor College of Law’s Sixth Annual Conference on Governance of Emerging Technologies & Science: Law, Policy and Ethics conference and the Eleventh Annual Privacy Law Scholars Conference. For excellent research assistance, I thank Paul Dimic and Ronald Waclawski. 1181 Final to Printer_Rozenshtein (Do Not Delete) 8/12/2019 2:23 PM 1182 U.C. IRVINE LAW REVIEW [Vol. 9:1181 neutral.”1 By this he meant to combat technological determinism, by which a particular technology has a “good” or “bad” essence that dictated its adoption by and effect on society. But Kranzberg’s law also cautioned against technological utopianism, the illusion that society can maintain full instrumental control of technology. A stark illustration of Kranzberg’s first law is modern information and communications technology. The Internet and its ecosystem of connected devices have profoundly altered individual and social life, including those aspects that are the topic of this symposium: the intersection of gender, law, and technology. Technology has enabled new forms of gender- and sexual-based crime and has frequently made it harder to prosecute those who commit sexual assault. Yet in many cases technology has also served as a shield for victims, getting them help and protecting their privacy. These effects, both negative and positive, have been of the unintended variety, as society grapples to adapt to technological change it does not fully understand. The Internet and its outgrowths have been neither good nor bad; but neither have they been neutral. Of particular importance has been ubiquitous strong encryption, one of the core technologies underpinning digital life. Since its adoption by business and the public in the late 1980s and early 1990s, the issue of law-enforcement access to encrypted data has been hotly debated in the legal, policy, and technology communities.2 After a decade and a half of relative peace, the “crypto wars” have started up again.3 The issue has seen a revival in legal scholarship,4 and it is also 1. Melvin Kranzberg, Technology and History: “Kranzberg’s Laws,” 27 TECH. & CULTURE 544, 545 (1986). 2. See generally A. Michael Froomkin, The Metaphor Is the Key: Cryptography, the Clipper Chip, and the Constitution, 143 U. PA. L. REV. 709 (1995). 3. The “crypto wars” is the common name for an intense period of policy debate in the 1990s between the government, Silicon Valley, and civil society over whether there should be any limits on the availability of strong encryption and, in particular, whether encryption systems should be designed to permit court-authorized government access to encrypted data. See Peter Swire & Kenesa Ahmad, Encryption and Globalization, 13 COLUM. SCI. & TECH. L. REV. 416, 433–41 (2012). 4. See, e.g., ASHLEY DEEKS, HOOVER INSTITUTION, THE INTERNATIONAL LEGAL DYNAMICS OF ENCRYPTION, Aegis Series Paper No. 1609 (2016), https://www.hoover.org/research/ international-legal-dynamics-encryption [https://perma.cc/SMY2-GK4F]; Justin (Gus) Hurwitz, EncryptionCongress mod (Apple + CALEA), 30 HARV. J.L. & TECH. 355 (2017); Geoffrey S. Corn, Averting the Inherent Dangers of “Going Dark”: Why Congress Must Require a Locked Front Door to Encrypted Data, 72 WASH. & LEE L. REV. 1433 (2015) [hereinafter Averting the Inherent Dangers]; Geoffrey S. Corn, Encryption, Asymmetric Warfare, and the Need for Lawful Access, 26 WM. & MARY BILL RTS. J. 337 (2017); Jamil N. Jaffer & Daniel J. Rosenthal, Decrypting Our Security: A Bipartisan Argument for a Rational Solution to the Encryption Challenge, 24 CATH. U. J.L. & TECH. 273 (2016); Orin S. Kerr & Bruce Schneier, Encryption Workarounds, 106 GEO. L.J. 989 (2018); Eric Manpearl, Preventing Going Dark: A Sober Analysis and Reasonable Solution to Preserve Security in the Encryption Debate, 28 U. FLA. J.L. & PUB. POL’Y 65 (2017); David W. Opderbeck, Encryption Policy and Law Enforcement in the Cloud, 49 CONN. L. REV. 1657 (2017); Stephanie K. Pell, You Can’t Always Get What You Want: How Will Law Enforcement Get What It Needs in a Post-CALEA, Cybersecurity-Centric Encryption Era?, 17 N.C. J.L. & TECH. 599 (2016); Swire & Ahmad, supra note 3. Final to Printer_Rozenshtein (Do Not Delete) 8/12/2019 2:23 PM 2019] WICKED CRYPTO 1183 salient in the policy arena, prompting high-profile reports from law-enforcement organizations,5 information security researchers,6 policy analysts,7 and multiple branches of government,8 including proposed legislation on all sides of the issue,9 at both the federal and state levels.10 This Article seeks to advance the debate around government access to encrypted data. Part I explains how encryption secures communications and data; how it helps protect victims of crime; and how it impedes law enforcement, particularly at the state and local levels. Part II, the analytical core of the Article, introduces the public-policy literature on “wicked problems” to explain why the encryption issue is such a difficult one. Part III suggests some changes to policy and institutional design. This Article aims at several audiences. The first is those—whether in the legal academy, government, industry, civil society, or the information-security community—who are working on the issue of law-enforcement access to encrypted data. We are in a critical period for this issue: public opinion is split on whether 5. See, e.g., INT’L ASS’N OF CHIEFS OF POLICE, DATA, PRIVACY AND PUBLIC SAFETY: A LAW ENFORCEMENT PERSPECTIVE ON THE CHALLENGES OF GATHERING ELECTRONIC EVIDENCE (2015); MANHATTAN DIST. ATTORNEY’S OFFICE, THIRD REPORT OF THE MANHATTAN DISTRICT ATTORNEY’S OFFICE ON SMARTPHONE ENCRYPTION (2017) [hereinafter MANHATTAN DA REPORT]. 6. Harold Abelson et al., Keys Under Doormats: Mandating Insecurity by Requiring Government Access to All Data and Communications, 1 J. CYBERSECURITY 69 (2015). 7. BERKMAN CTR. FOR INTERNET & SOCIETY AT HARVARD UNIV., DON’T PANIC: MAKING PROGRESS ON THE “GOING DARK” DEBATE (2016) [hereinafter DON’T PANIC]; THE CHERTOFF GRP., THE GROUND TRUTH ABOUT ENCRYPTION AND THE CONSEQUENCES OF EXTRAORDINARY ACCESS (2016); CHARLES DUAN ET AL., POLICY APPROACHES TO THE ENCRYPTION DEBATE (R. Street Policy Study No. 133, 2018); EASTWEST INST., ENCRYPTION POLICY IN DEMOCRATIC REGIMES: FINDING CONVERGENT PATHS AND BALANCED SOLUTIONS (2018); JAMES A. LEWIS ET AL., CENTER FOR STRATEGIC & INTERNATIONAL STUDIES, THE EFFECT OF ENCRYPTION ON LAWFUL